Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -49,10 +49,11 @@ static void configureCliEnv(EnvVars env, FilePath jfrogHomeTempDir, JFrogCliConf
setupProxy(env);
}
if (encryptionKey.shouldEncrypt()) {
// Write the encryption key file on the agent (not controller) using FilePath.
// This ensures the file exists where the JFrog CLI runs (Docker/remote agent).
// Write the encryption key file on the current agent using FilePath.
// Always overwrite (not putIfAbsent) because in multi-agent pipelines the env
// var may still hold the previous agent's path, which doesn't exist on this agent.
String keyFilePath = encryptionKey.writeKeyFile(jfrogHomeTempDir);
env.putIfAbsent(JFROG_CLI_ENCRYPTION_KEY, keyFilePath);
env.put(JFROG_CLI_ENCRYPTION_KEY, keyFilePath);
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,10 @@ public JFrogCliConfigEncryption(EnvVars env) {
/**
* Writes the encryption key to a file in the specified directory on the agent.
* Uses FilePath to ensure the file is written on the remote agent, not the controller.
* <p>
* The key file is always written fresh to the given jfrogHomeTempDir. In multi-agent
* pipelines each agent has its own filesystem, so the file must be written locally on
* every agent where the JFrog CLI runs. The key content stays the same across agents.
*
* @param jfrogHomeTempDir - The JFrog CLI home temp directory (FilePath on the agent)
* @return The path to the key file (as seen by the agent)
Expand All @@ -46,17 +50,15 @@ public String writeKeyFile(FilePath jfrogHomeTempDir) throws IOException, Interr
if (this.key == null || this.key.isEmpty()) {
return null;
}
// If key file was already written, return the existing path
if (this.keyFilePath != null) {
return this.keyFilePath;
}
// Use FilePath operations to write on the agent (not controller)
// Always write the key file on the current agent's filesystem.
// Do NOT cache/reuse keyFilePath: in multi-agent pipelines each agent has its own
// filesystem, so returning a previously cached path would point to a different
// agent's file which does not exist on the current agent.
FilePath encryptionDir = jfrogHomeTempDir.child("encryption");
encryptionDir.mkdirs();
String fileName = UUID.randomUUID().toString() + ".key";
FilePath keyFile = encryptionDir.child(fileName);
keyFile.write(this.key, StandardCharsets.UTF_8.name());
// getRemote() returns the path as seen by the agent
this.keyFilePath = keyFile.getRemote();
return this.keyFilePath;
}
Expand Down